| HttpService: getRequestDispatcher returns null for different httpContext [message #62486] |
Wed, 22 February 2006 22:46 |
 Harald Niesche
Messages: 23
Registered: July 2009 |
Junior Member |
|
|
Hi,
I am trying to use the equinox HttpService and I stumbled about this:
In the equinox ServletContext implementation, a RequestDispatcher is
only returned from servletContext.getRequestDispatcher() if it stays
within the same HttpContext.
(line 196 in ServletContextImpl:)
if (httpContext != reg.getHttpContext()) {
return (null);
}
The only thing I can find about this in OSGi spec is that all servlets
registered using the same HttpContext share the same ServletContext.
The servlet API says that getRequestDispatcher can only return a
RequestDispatcher for the same ServletContext, but it also suggests
using getContext() to obtain a RequestDispatcher for another context,
but in the HttpService they all have the same contextPath ... and the
ServletContextImpl won't return a context for another HttpContext, either.
I don't believe the bridge servlet ProxyServlet currently has this
limitation (although it doesn't implement getContext() correctly if I
try to look up my own context).
Unfortunately, while being perfectly legal under all the specifications
concerned, this behaviour seriously limits the usefulness of the
getRequestDispatcher() method if we want to build modular webapps with
equinox.
Is allowing access to another HttpContext really a horrible security
risk? Would it at least be possible to make this configurable?
Harald
|
|
|
Powered by
FUDForum. Page generated in 0.02558 seconds
] 
Search
Help
Register
Login
Home
